AVAST报威金！【fc85ad f0f88】

显示全部楼层 · 发表于 2007-6-24 14:21:34

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\威金.rar'
C:\Documents and Settings\Administrator\My Documents\
  威金.rar
[0] Archive type: RAR
--> svchost.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> SysAuto.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-6-24 14:21:36

病毒: Worm.Win32.Viking.gz
檔案: 威金[1].rar
目錄: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XAG0GEON
處理序: GreenBrowser.exe

显示全部楼层 · 发表于 2007-6-24 14:22:27

显示全部楼层 · 发表于 2007-6-24 14:23:21

D:\Program Files\a2cmd>a2cmd /f="C:\" /h /r /a /n

a-squared Command Line Scanner v. 3.0.0.118
(C) 2003-2007 Emsi Software GmbH - www.emsisoft.com

a-squared Command Line Scanner - Version 3.0
Last update: N/A

Scan settings:

Objects:          C:\
Scan archives:    On
Heuristics:       On
ADS Scan:       On

Scan start:       2007-6-24 14:28:08

C:\ABC\威金.rar/svchost.exe    detected: Worm.Win32.Viking.gz
C:\ABC\威金.rar/SysAuto.exe    detected: Worm.Win32.Viking.gz

Scanned

Files:          119
Traces:          0
Cookies:          0
Processes:       0

Found

Files:          2
Traces:          0
Cookies:          0
Processes:       0

Scan end:       2007-6-24 14:28:09
Scan time:       0:00:01
终止批处理操作吗(Y/N)?

显示全部楼层 · 发表于 2007-6-24 14:24:55

Scan performed at: 2007-6-24 14:29:45
Scanning Log
NOD32 version 2349 (20070623) NT
Command line: C:\Documents and Settings\EQ2\桌面\威金.rar
Operating memory - is OK

Date: 24.6.2007 Time: 14:29:50
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\威金.rar
C:\Documents and Settings\EQ2\桌面\威金.rar ?RAR ?svchost.exe - Win32/Viking.CH virus - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\威金.rar ?RAR ?SysAuto.exe - Win32/Viking.CH virus - was a part of the deleted object
Number of scanned files: 3
Number of threats found: 2
Number of files cleaned: 1
Time of completion: 14:29:51 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-6-24 14:29:44

2007/6/24 14:23:30 Scanning Log
2007/6/24 14:23:30 Version of virus signature database: 2349 (20070623)
2007/6/24 14:23:30 Date: 24.6.2007 Time: 14:23:30
2007/6/24 14:23:30 Scanned disks, folders and files: D:\病毒\
2007/6/24 14:23:32 D:\病毒\威金.rar - Win32/Viking.CH virus - deleted - quarantined
2007/6/24 14:23:32 D:\病毒\威金.rar » RAR » svchost.exe - Win32/Viking.CH virus
2007/6/24 14:23:32 D:\病毒\威金.rar » RAR » SysAuto.exe - Win32/Viking.CH virus
2007/6/24 14:23:32 Number of scanned files: 3
2007/6/24 14:23:32 Number of threats found: 2
2007/6/24 14:23:32 Time of completion: 14:23:32 Total scanning time: 2 sec (00:00:02)

显示全部楼层 · 发表于 2007-6-24 15:47:07

扫描开始时间: 2007-6-24 15:51:41
日期: 2007年6月24日时间: 15:51:44
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\virus\威金.rar
F:\virus\威金.rar ?RAR ?svchost.exe<病毒 - Win32/Viking.CH 病毒> - 是删除目标的一部分
F:\virus\威金.rar ?RAR ?SysAuto.exe<病毒 - Win32/Viking.CH 病毒> - 是删除目标的一部分
已扫描文件数量: 3
已发现病毒数量: 2
已清除病毒的文件数量: 1
完成时间: 15:51:44 总共扫描时间: 0 秒 (00:00:00)

显示全部楼层 · 发表于 2007-6-24 15:48:27

detected: virus Worm.Win32.Viking.gz URL: http://bbs.kafan.cn/attachment.php?aid=92307//svchost.exe

显示全部楼层 · 发表于 2007-6-24 16:08:41

微点一个已知，一个行为判断截杀：

运行sysauto.exe后：

[病毒样本] AVAST报威金！【fc85ad f0f88】

本帖子中包含更多资源

扫：威金

本帖子中包含更多资源

本帖子中包含更多资源